Skip to content

vey-proxy-v1.13.9

Choose a tag to compare

View all tags
@zh-jq zh-jq released this 26 Jul 07:56
· 202 commits to main since this release
vey-proxy-v1.13.9
b4db3b4

This is a new version in the vey-proxy 1.13 development branch.

fixed bugs

  • BUG FIX: HTTP clients sending trailers split across packets (CRLF alone in a later read) no longer stall or fail trailer parsing
  • BUG FIX: domains that resolve to CNAME-only answers no longer deadlock the Hickory resolver (lookups can complete / follow CNAME again)
  • BUG FIX: MASQUE CONNECT-UDP capsule encoding matches the spec so UDP-over-HTTP peers interoperate correctly
  • BUG FIX: H2 ICAP/preview idle timers advance when data arrives, so busy preview streams are not closed as idle
  • BUG FIX: route_geoip continent rules match again (continent-based routing no longer silently falls through)
  • BUG FIX: IMAP UNSUBSCRIBE / ENABLE and non-synchronizing literals ({N+}) are recognized, so those client commands work through inspection
  • BUG FIX: malformed or negative LDAP BER integers/lengths are rejected instead of panicking or mis-decoding binds with long DNs
  • BUG FIX: zero-size and size-limited FTP downloads finish or stop at the configured limit instead of hanging or reading past the limit
  • BUG FIX: empty/oversized TLS ClientHello fragments are rejected in sni_proxy and TLS interception, bounding memory use from bad clients
  • BUG FIX: short SOCKS5 UDP datagrams no longer panic the worker; only the received bytes are parsed
  • BUG FIX: requests with both Transfer-Encoding and Content-Length drop CL and disable keep-alive, blocking request-smuggling shapes
  • BUG FIX: overflowing HTTP chunk sizes are rejected (no wrap/panic), blocking smuggling via huge chunk lengths
  • BUG FIX: failed HTTP CONNECT/Upgrade under H1 interception returns the client stream to the pipeline instead of leaving the connection hung
  • BUG FIX: Host suffix / child domain ACLs and routes use longest-prefix match again, so a.b.example.com matches the intended rule
  • BUG FIX: User-Agent ACL matching no longer panics on non-ASCII headers
  • BUG FIX: DNS cache TTLs no longer overflow; positive answers use the minimum A/AAAA TTL (c-ares and Hickory), so records do not stick longer than intended
  • BUG FIX: oversized CONNECT-UDP datagrams are failed explicitly instead of being dropped while still reported as success
  • BUG FIX: route escapers keep remote/egress notes on HTTP forward, so audit/egress headers are not lost after routing
  • BUG FIX: dead keep-alive upstream HTTP connections are detected and replaced instead of being reused until write fails
  • BUG FIX: long FTP directory listing lines are split across chunked HTTP responses instead of truncating the listing
  • BUG FIX: upstream responses with non-chunked Transfer-Encoding are read until close (conflicting CL dropped), avoiding body/desync issues
  • BUG FIX: after HTTP proxy auth failure, the next keep-alive request on the same connection cannot reuse the previous user's egress path
  • BUG FIX: sni_proxy task stats no longer double-count pre-handshake client bytes
  • BUG FIX: oversized msgpack / ICAP Options-TTL / QUIC ACK-range inputs are rejected instead of wrapping or panicking
  • BUG FIX: ICAP Preview: 0 is treated as no preview, so REQMOD no longer drops or corrupts request bodies
  • BUG FIX: global UDP rate limits refund tokens on Pending/error and charge by payload size, so limits and traffic stats match real datagrams
  • BUG FIX: UDP copy/batch receive sets packet bounds correctly, avoiding truncated or misframed SOCKS/UDP payloads
  • BUG FIX: after resolver client rebuild, the new Hickory client is installed reliably under load (fewer stuck DNS lookups)
  • BUG FIX: stripping default ports from Host no longer corrupts IPv6 literals and only strips when the port is the real default
  • BUG FIX: protocol inspection stops when the peek buffer is full (and treats initial EOF as closed), avoiding stuck or unbounded inspect
  • BUG FIX: RateLimiter reload keeps the intended burst size; connection each_timeout: 0 is ignored so reload/limit_to cannot force instant connect failure
  • BUG FIX: empty ip-locate results no longer pin an IP forever, so geo routing can retry later
  • BUG FIX: forged/mitm certificate validity periods use the configured day count correctly (seconds conversion)
  • BUG FIX: password hashes with explicit rounds= verify like libcrypt again (xcrypt)
  • BUG FIX: selective routing (ketama / consistent hash) ignores invalid zero weights and avoids overflow skew
  • BUG FIX: count-based rate limiters restore remaining quota on reset instead of dropping to zero
  • BUG FIX: CONNECT-UDP under send rate-limit retries without dropping the datagram
  • BUG FIX: reloading PlainQuicPort keeps the TLS session ticketer so clients can still resume tickets

New Features

  • Feature: reload the running process via RPC/ctl (reload) without a full restart
  • Feature: PlainQuicPort gains QuinnEndpointConfig and udp_max_payload_size for QUIC tuning
  • Feature: TCP/UDP listen configs can enable use_ebpf for reuseport selection where supported
  • Feature: PlainQuicPort can use eBPF reuseport selection on Linux so multiproc QUIC stays sticky by connection
Assets 2
Loading